Klez.h is proving to be the No. 1 son of the original Klez virus, leaving its sibling Klez.i in the dust and overtaking SirCam as the most virulent computer virus yet.

According to antivirus company MessageLabs, which contracts with businesses to scan e-mails for malicious attachments, Klez.h overtook SirCam on Sunday and continues to spread.

Combined, the H and I variants of the original Klez worm had already shot past SirCam on the list of most-widespread worms. But Klez.h is proving to be the favorite child.

MessageLabs' servers have been blocking up to 20,000 copies of the worm every working day since late April--the month Klez.h appeared--stopping more than 800,000 copies to date. At the height of SirCam's reign, MessageLabs was grabbing more than 10,000 copies of that worm a day.

"We do have more customers now than when SirCam was out," said Alex Shipp, antivirus technologist at MessageLabs. "But even adjusting for that, we believe Klez is the more widespread."

By the time its run began to slow, SirCam had infected millions of computers worldwide and had caused at least a billion dollars in damages related to cleaning infected systems and to lost productivity.

Klez.h, however, is primarily affecting home users and small businesses, said Shipp. "There appears to be very few corporates infected."

Master of disguise
The remarkable success of Klez.h is largely the result of the different methods it uses to disguise itself and spread.

"There are a lot of people on the Internet without any virus protection whatsoever, and they tend to avoid viruses by recognizing subject lines and content," said Shipp. But that's where the contents of Klez.h's disguise kit come into play.

First of all, Klez.h hides behind one of 120 possible e-mail subject lines. There are 18 different standard subject headings the worm uses, including "let's be friends," "meeting notice," "some questions," and "honey." On top of those, Klez.h uses seven other patterns, such as "a x game" and "a x patch," where x can be one of 16 different words, including "new," "WinXP," and the name of any of six major antivirus companies.

Klez.h also forges the name of the e-mail's sender. The worm searches a host of different file types on the infected PC to come up with e-mail addresses from which to grab aliases. It also sends itself to those addresses, using its own mail program.

And as far as the content part of the e-mail goes, Klez.h also plays tricks with its file name. The malicious program finds any network storage available on the infected PC and copies itself to the remote disk drives using a random file name and a .EXE, .PIF, .COM, .BAT, .SCR or .RAR extension. Occasionally, the file name will include a double extension.

On top of all that, in some circumstances, Klez.h doesn't even need the victim to open it in order to run. Instead, it takes advantage of a 12-month-old vulnerability in Microsoft Outlook--known as the Automatic Execution of Embedded MIME Type bug--to open itself automatically on unpatched versions of Outlook.

A final problem with Klez.h is that--because of the forged senders' names--many people are unaware that their PCs are infected. "Everybody who receives the virus is alerting everybody else, but the person who owns the infected PC remains blissfully unaware because everybody is alerting the wrong person," said Shipp. "In the past someone would eventually tell you if you had a virus, but you cannot count on this happening any more."

Family affair
It's unclear, though, why Klez.h has been so much more successful than its sibling, which uses some of the same techniques Klez.h exploits so well.

Klez.i made its debut on the same day Klez.h was released into the wild. "But we only ever saw two copies of Klez.i," said Shipp. "Meanwhile, Klez.h has gone bananas. Why one has made it and the other (has) not we don't know. It might be that the virus writer seeded the different versions to different e-mail groups, and one was more active, so that virus reached a critical mass."

Report offensive content:

If you believe this comment is offensive or violates the CNET's Site Terms of Use, you can report it below (this will not automatically remove the comment). Once reported, our staff will be notified and the comment will be reviewed.

E-mail this comment to a friend.

E-mail this to:

Note: Your e-mail address is used only to let the recipient know who sent the e-mail and in case of transmission error. Neither your address nor the recipients's address will be used for any other purpose.